generated: '2026-07-20'
method: derived
source: openapi/ostrom-openapi-original.json
summary: >-
  Cross-cutting standards conformance derived from the Ostrom OpenAPI and docs.
  The API uses OAuth2 (client-credentials) and a custom JSON error envelope
  (not RFC 9457). No published SOC 2 / ISO 27001 / other compliance program was
  found on the developer or trust surface.
standards:
- id: oauth2
  conforms: true
  evidence: openapi securitySchemes type oauth2, clientCredentials flow with token endpoint
- id: oauth2-client-credentials
  conforms: true
  evidence: RFC 6749 client_credentials grant with HTTP Basic client auth
- id: openapi-3.1
  conforms: true
  evidence: openapi 3.1.0 document published at production.ostrom-api.io
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use a custom {type, detail} JSON envelope, not application/problem+json
- id: webhook-hmac-signatures
  conforms: true
  evidence: X-Ostrom-Signature HMAC-SHA1 payload signing documented
- id: json-api
  conforms: false
- id: fhir
  conforms: false
- id: fapi
  conforms: false
- id: scim
  conforms: false
- id: odata
  conforms: false
compliance_program:
  published: false
  notes: No named certifications (SOC 2, ISO 27001, PCI, GDPR page) found on the developer or trust surface. Ostrom is a certified B Corporation (corporate, not a security cert).